Block insecure ways of pulling from private repositories by default

See comment https://github.com/jupyterhub/nbgitpuller/issues/85#issuecomment-496654302 for a lot more detail

Since we don't have good support for pulling from private repositories, folks often put their own personal access tokens in the nbgitpuller URL.

This is extremely dangerous, and the same as sharing your password. We should detect and block this, but only after making sure we have some easy way for folks to pull from private repositories.